CVE-2026-27882

Published: Jun 30, 2026Modified: Jun 30, 2026Deferred

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

Related CWEs

CWE-208

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (2)

https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-x525-46rq-mr8c

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.